“Appeal for general adoption of IPv6 has fallen largely on deaf ears”
RDI will continue promoting internet standards through its inspection activities
In recent years, where modern internet standards are concerned, the Dutch Authority for Digital Infrastructure (RDI) has focused mainly on BGP/RPKI and IPv6. Sadly, however, the RDI's appeal for the general adoption of IPv6 has largely fallen on deaf ears. Nevertheless, the RDI will continue to stress the importance of internet standards to the organisations it supervises.
The Authority also intends to make use of data from scans by the Internet Cleanup Foundation for its supervision work. “Our inspectors will be talking to organisations flagged up by the scans as poor performers about the importance of adopting standards, and asking them why they haven't done so.”
For several years now, the remit of the Dutch Authority for Digital Infrastructure (RDI, known as the Radiocommunications Agency until last year) has included digital resilience. The RDI also has responsibilities under European legislation such eIDAS and NIS(2) [Wbni] plus the new Cyber Resilience Act and AI Act. The Digital Europe programme has implications for the organisation as well.
BGP/RPKI and IPv6
Where modern internet standards are concerned, the RDI has for the last 2 years focused mainly on BGP/RPKI and IPv6. That focus was informed by the Stratix report Internet Infrastructure: Standardisation, Technology and Geopolitics, published in December 2022. Stratix highlighted BGP route hijacking, IP spoofing and the slow adoption of IPv6 as key issues relating specifically to internet (security) standards.
Against that background, the RDI joined the Platform for Internet Standards – best known for its Internet.nl test portal – and the Forum for Standardisation in 2023. The RDI is also a member of the Dutch National Anti-DDOS Coalition and attends meetings of the Dutch Network Operator Group (NLNOG). In addition, the RDI last summer teamed up with the Dutch Cloud Community (DCC, an organisation for internet service providers in the Netherlands) to deliver an information session on the theme of DDoS resilience.
Internet Cleanup Foundation scans
However, in its latest annual report, the RDI concludes that its “appeal for the general adoption of IPv6 has largely fallen on deaf ears”. The report goes on to say that the Authority will nevertheless "continue to draw attention to the matter".
“Standardisation and the use of standards have a permanent place in the RDI's programme,” said a spokesperson. “Every 2 to 3 years, we choose a standardisation-related theme for extra emphasis in the context of our activities. We align the work we do on that theme with live issues in the relevant field. In the period ahead, the priority will be bringing internet standards to the attention of the organisations we supervise.”
The RDI also intends to start making use of the results of scans carried out by the Internet Cleanup Foundation (ICF). The ICF's mission is to increase the availability, integrity and confidentiality of information on the internet. One way it seeks to do that is by scanning the internet presences of organisations in critical sectors, and then publishing the results on basisbeveiliging.nl. The RDI has agreed to sponsor the ICF for 3 years, to the tune of €20,000 a year.
Figure 1: The digital security of organizations in the Dutch energy sector. These are part of the critical infrastructure. [bron: Basisbeveiliging]
Digital resilience
The RDI intends to evaluate the ICF's scan data and assess its suitability for future use in the context of the Authority's supervisory activities, particularly as a means of estimating digital resilience risks. The RDI is interested specifically in companies and other organisations that form part of the nation's critical infrastructure and fall within the scope of NIS(2)-based legislation.
“The ICF's maps show how far different sectors and organisations have come in terms of adopting relevant standards. Our inspectors will be talking to organisations flagged up by the scans as poor performers about the importance of adopting standards, and asking them why they haven't done so.”
The use of standards and protocols will also be addressed in the context of the inspections that the RDI performs on companies providing internet and network services to consumers using xDSL, cable or fibre networks. Under the new Telecommunications Act and the Decree on the Security and Continuity of Public Electronic Communication Networks and Services, such companies will have a more strictly defined duty of care and reporting obligations. “We'll be emphasising to them the importance of implementing internet standards such as those on the 'use-or-explain' list. Each year, we'll decide what we should focus on in the period ahead.”